payload-rbac-plugin 1.0.3-rc1 → 1.0.5-rc

package/dist/collections/Permissions.js

@@ -4,8 +4,11 @@ export const createPermissionsCollection = (options)=>{
     const customFields = options.permissionsFields || [];
     return {
         slug,
-        access: {
-            read: ()=>true
+        access: options.permissionsAccess || {
+            create: ()=>true,
+            delete: ()=>true,
+            read: ()=>true,
+            update: ()=>true
         },
         admin: {
             group: 'Access Control',
@@ -49,6 +52,75 @@ export const createPermissionsCollection = (options)=>{
                     return true;
                 }
             },
+            {
+                name: 'conditions',
+                type: 'array',
+                admin: {
+                    condition: (data)=>data?.type === 'single',
+                    description: 'Add dynamic row-level security constraints to this permission. If specified, this permission will only grant access to documents matching these conditions.'
+                },
+                fields: [
+                    {
+                        name: 'field',
+                        type: 'text',
+                        required: true,
+                        admin: {
+                            description: 'The document field to check (e.g. "sender" or "status").'
+                        }
+                    },
+                    {
+                        name: 'operator',
+                        type: 'select',
+                        required: true,
+                        defaultValue: 'equals',
+                        options: [
+                            {
+                                label: 'Equals',
+                                value: 'equals'
+                            },
+                            {
+                                label: 'Not Equals',
+                                value: 'not_equals'
+                            },
+                            {
+                                label: 'In',
+                                value: 'in'
+                            },
+                            {
+                                label: 'Not In',
+                                value: 'not_in'
+                            },
+                            {
+                                label: 'Exists',
+                                value: 'exists'
+                            },
+                            {
+                                label: 'Greater Than',
+                                value: 'greater_than'
+                            },
+                            {
+                                label: 'Less Than',
+                                value: 'less_than'
+                            },
+                            {
+                                label: 'Like',
+                                value: 'like'
+                            },
+                            {
+                                label: 'Contains',
+                                value: 'contains'
+                            }
+                        ]
+                    },
+                    {
+                        name: 'value',
+                        type: 'text',
+                        admin: {
+                            description: 'Value to compare against. Supports {{user.id}}, {{user.roles}}, {{user.role}} variables.'
+                        }
+                    }
+                ]
+            },
             {
                 name: 'collectionName',
                 type: 'text',

package/dist/collections/Permissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/collections/Permissions.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport type { PluginOptions } from '../types'\n\nimport { createBeforePermissionChangeHook } from '../hooks/beforePermissionChange'\n\nexport const createPermissionsCollection = (options: PluginOptions): CollectionConfig => {\n  const slug = options.permissionsCollectionSlug || 'permissions'\n  const customFields = options.permissionsFields || []\n\n  return {\n    slug,\n    access: {\n      read: () => true,\n    },\n    admin: {\n      group: 'Access Control',\n      hidden: options.hidePermissions ?? false,\n      useAsTitle: 'name',\n    },\n    fields: [\n      {\n        name: 'type',\n        type: 'select',\n        admin: {\n          condition: (data) => !data?.id && !data?._id && !data?.createdAt,\n          description:\n            'Choose whether to create a single custom permission or generate multiple CRUD permissions at once.',\n          disableListColumn: true,\n          disableListFilter: true,\n        },\n        defaultValue: 'single',\n        options: [\n          { label: 'Single Permission', value: 'single' },\n          { label: 'Bulk CRUD Generator', value: 'bulk' },\n        ],\n      },\n      {\n        name: 'name',\n        type: 'text',\n        admin: {\n          condition: (data) => data?.type === 'single',\n          description: 'The unique name of the permission (e.g., \"access:admin\", \"posts:create\").',\n        },\n        unique: true,\n        validate: (value: null | string | undefined, { data }: { data?: any }) => {\n          if (data?.type === 'single' && !value) {\n            return 'Name is required for single permissions.'\n          }\n          return true\n        },\n      },\n      {\n        name: 'collectionName',\n        type: 'text',\n        admin: {\n          condition: (data) => data?.type === 'bulk',\n          description: 'Enter a collection slug (e.g., \"posts\") to auto-generate permissions.',\n          disableListColumn: true,\n          disableListFilter: true,\n        },\n      },\n      {\n        type: 'row',\n        fields: [\n          {\n            name: 'create',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n          {\n            name: 'read',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n          {\n            name: 'update',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n          {\n            name: 'delete',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n        ],\n      },\n      ...customFields,\n    ],\n    hooks: {\n      beforeChange: [createBeforePermissionChangeHook(slug)],\n    },\n  }\n}\n"],"names":["createBeforePermissionChangeHook","createPermissionsCollection","options","slug","permissionsCollectionSlug","customFields","permissionsFields","access","read","admin","group","hidden","hidePermissions","useAsTitle","fields","name","type","condition","data","id","_id","createdAt","description","disableListColumn","disableListFilter","defaultValue","label","value","unique","validate","width","hooks","beforeChange"],"mappings":"AAIA,SAASA,gCAAgC,QAAQ,kCAAiC;AAElF,OAAO,MAAMC,8BAA8B,CAACC;IAC1C,MAAMC,OAAOD,QAAQE,yBAAyB,IAAI;IAClD,MAAMC,eAAeH,QAAQI,iBAAiB,IAAI,EAAE;IAEpD,OAAO;QACLH;QACAI,QAAQ;YACNC,MAAM,IAAM;QACd;QACAC,OAAO;YACLC,OAAO;YACPC,QAAQT,QAAQU,eAAe,IAAI;YACnCC,YAAY;QACd;QACAC,QAAQ;YACN;gBACEC,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAAS,CAACA,MAAMC,MAAM,CAACD,MAAME,OAAO,CAACF,MAAMG;oBACvDC,aACE;oBACFC,mBAAmB;oBACnBC,mBAAmB;gBACrB;gBACAC,cAAc;gBACdvB,SAAS;oBACP;wBAAEwB,OAAO;wBAAqBC,OAAO;oBAAS;oBAC9C;wBAAED,OAAO;wBAAuBC,OAAO;oBAAO;iBAC/C;YACH;YACA;gBACEZ,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;oBACpCM,aAAa;gBACf;gBACAM,QAAQ;gBACRC,UAAU,CAACF,OAAkC,EAAET,IAAI,EAAkB;oBACnE,IAAIA,MAAMF,SAAS,YAAY,CAACW,OAAO;wBACrC,OAAO;oBACT;oBACA,OAAO;gBACT;YACF;YACA;gBACEZ,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;oBACpCM,aAAa;oBACbC,mBAAmB;oBACnBC,mBAAmB;gBACrB;YACF;YACA;gBACER,MAAM;gBACNF,QAAQ;oBACN;wBACEC,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBM,OAAO;wBACT;wBACAL,cAAc;oBAChB;oBACA;wBACEV,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBM,OAAO;wBACT;wBACAL,cAAc;oBAChB;oBACA;wBACEV,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBM,OAAO;wBACT;wBACAL,cAAc;oBAChB;oBACA;wBACEV,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBM,OAAO;wBACT;wBACAL,cAAc;oBAChB;iBACD;YACH;eACGpB;SACJ;QACD0B,OAAO;YACLC,cAAc;gBAAChC,iCAAiCG;aAAM;QACxD;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/collections/Permissions.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport type { PluginOptions } from '../types'\n\nimport { createBeforePermissionChangeHook } from '../hooks/beforePermissionChange'\n\nexport const createPermissionsCollection = (options: PluginOptions): CollectionConfig => {\n  const slug = options.permissionsCollectionSlug || 'permissions'\n  const customFields = options.permissionsFields || []\n\n  return {\n    slug,\n    access: options.permissionsAccess || {\n      create: () => true,\n      delete: () => true,\n      read: () => true,\n      update: () => true,\n    },\n    admin: {\n      group: 'Access Control',\n      hidden: options.hidePermissions ?? false,\n      useAsTitle: 'name',\n    },\n    fields: [\n      {\n        name: 'type',\n        type: 'select',\n        admin: {\n          condition: (data) => !data?.id && !data?._id && !data?.createdAt,\n          description:\n            'Choose whether to create a single custom permission or generate multiple CRUD permissions at once.',\n          disableListColumn: true,\n          disableListFilter: true,\n        },\n        defaultValue: 'single',\n        options: [\n          { label: 'Single Permission', value: 'single' },\n          { label: 'Bulk CRUD Generator', value: 'bulk' },\n        ],\n      },\n      {\n        name: 'name',\n        type: 'text',\n        admin: {\n          condition: (data) => data?.type === 'single',\n          description: 'The unique name of the permission (e.g., \"access:admin\", \"posts:create\").',\n        },\n        unique: true,\n        validate: (value: null | string | undefined, { data }: { data?: any }) => {\n          if (data?.type === 'single' && !value) {\n            return 'Name is required for single permissions.'\n          }\n          return true\n        },\n      },\n      {\n        name: 'conditions',\n        type: 'array',\n        admin: {\n          condition: (data) => data?.type === 'single',\n          description:\n            'Add dynamic row-level security constraints to this permission. If specified, this permission will only grant access to documents matching these conditions.',\n        },\n        fields: [\n          {\n            name: 'field',\n            type: 'text',\n            required: true,\n            admin: {\n              description: 'The document field to check (e.g. \"sender\" or \"status\").',\n            },\n          },\n          {\n            name: 'operator',\n            type: 'select',\n            required: true,\n            defaultValue: 'equals',\n            options: [\n              { label: 'Equals', value: 'equals' },\n              { label: 'Not Equals', value: 'not_equals' },\n              { label: 'In', value: 'in' },\n              { label: 'Not In', value: 'not_in' },\n              { label: 'Exists', value: 'exists' },\n              { label: 'Greater Than', value: 'greater_than' },\n              { label: 'Less Than', value: 'less_than' },\n              { label: 'Like', value: 'like' },\n              { label: 'Contains', value: 'contains' },\n            ],\n          },\n          {\n            name: 'value',\n            type: 'text',\n            admin: {\n              description:\n                'Value to compare against. Supports {{user.id}}, {{user.roles}}, {{user.role}} variables.',\n            },\n          },\n        ],\n      },\n      {\n        name: 'collectionName',\n        type: 'text',\n        admin: {\n          condition: (data) => data?.type === 'bulk',\n          description: 'Enter a collection slug (e.g., \"posts\") to auto-generate permissions.',\n          disableListColumn: true,\n          disableListFilter: true,\n        },\n      },\n      {\n        type: 'row',\n        fields: [\n          {\n            name: 'create',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n          {\n            name: 'read',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n          {\n            name: 'update',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n          {\n            name: 'delete',\n            type: 'checkbox',\n            admin: {\n              condition: (data) => data?.type === 'bulk',\n              disableListColumn: true,\n              disableListFilter: true,\n              width: '25%',\n            },\n            defaultValue: false,\n          },\n        ],\n      },\n      ...customFields,\n    ],\n    hooks: {\n      beforeChange: [createBeforePermissionChangeHook(slug)],\n    },\n  }\n}\n"],"names":["createBeforePermissionChangeHook","createPermissionsCollection","options","slug","permissionsCollectionSlug","customFields","permissionsFields","access","permissionsAccess","create","delete","read","update","admin","group","hidden","hidePermissions","useAsTitle","fields","name","type","condition","data","id","_id","createdAt","description","disableListColumn","disableListFilter","defaultValue","label","value","unique","validate","required","width","hooks","beforeChange"],"mappings":"AAIA,SAASA,gCAAgC,QAAQ,kCAAiC;AAElF,OAAO,MAAMC,8BAA8B,CAACC;IAC1C,MAAMC,OAAOD,QAAQE,yBAAyB,IAAI;IAClD,MAAMC,eAAeH,QAAQI,iBAAiB,IAAI,EAAE;IAEpD,OAAO;QACLH;QACAI,QAAQL,QAAQM,iBAAiB,IAAI;YACnCC,QAAQ,IAAM;YACdC,QAAQ,IAAM;YACdC,MAAM,IAAM;YACZC,QAAQ,IAAM;QAChB;QACAC,OAAO;YACLC,OAAO;YACPC,QAAQb,QAAQc,eAAe,IAAI;YACnCC,YAAY;QACd;QACAC,QAAQ;YACN;gBACEC,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAAS,CAACA,MAAMC,MAAM,CAACD,MAAME,OAAO,CAACF,MAAMG;oBACvDC,aACE;oBACFC,mBAAmB;oBACnBC,mBAAmB;gBACrB;gBACAC,cAAc;gBACd3B,SAAS;oBACP;wBAAE4B,OAAO;wBAAqBC,OAAO;oBAAS;oBAC9C;wBAAED,OAAO;wBAAuBC,OAAO;oBAAO;iBAC/C;YACH;YACA;gBACEZ,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;oBACpCM,aAAa;gBACf;gBACAM,QAAQ;gBACRC,UAAU,CAACF,OAAkC,EAAET,IAAI,EAAkB;oBACnE,IAAIA,MAAMF,SAAS,YAAY,CAACW,OAAO;wBACrC,OAAO;oBACT;oBACA,OAAO;gBACT;YACF;YACA;gBACEZ,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;oBACpCM,aACE;gBACJ;gBACAR,QAAQ;oBACN;wBACEC,MAAM;wBACNC,MAAM;wBACNc,UAAU;wBACVrB,OAAO;4BACLa,aAAa;wBACf;oBACF;oBACA;wBACEP,MAAM;wBACNC,MAAM;wBACNc,UAAU;wBACVL,cAAc;wBACd3B,SAAS;4BACP;gCAAE4B,OAAO;gCAAUC,OAAO;4BAAS;4BACnC;gCAAED,OAAO;gCAAcC,OAAO;4BAAa;4BAC3C;gCAAED,OAAO;gCAAMC,OAAO;4BAAK;4BAC3B;gCAAED,OAAO;gCAAUC,OAAO;4BAAS;4BACnC;gCAAED,OAAO;gCAAUC,OAAO;4BAAS;4BACnC;gCAAED,OAAO;gCAAgBC,OAAO;4BAAe;4BAC/C;gCAAED,OAAO;gCAAaC,OAAO;4BAAY;4BACzC;gCAAED,OAAO;gCAAQC,OAAO;4BAAO;4BAC/B;gCAAED,OAAO;gCAAYC,OAAO;4BAAW;yBACxC;oBACH;oBACA;wBACEZ,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLa,aACE;wBACJ;oBACF;iBACD;YACH;YACA;gBACEP,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;oBACpCM,aAAa;oBACbC,mBAAmB;oBACnBC,mBAAmB;gBACrB;YACF;YACA;gBACER,MAAM;gBACNF,QAAQ;oBACN;wBACEC,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBO,OAAO;wBACT;wBACAN,cAAc;oBAChB;oBACA;wBACEV,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBO,OAAO;wBACT;wBACAN,cAAc;oBAChB;oBACA;wBACEV,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBO,OAAO;wBACT;wBACAN,cAAc;oBAChB;oBACA;wBACEV,MAAM;wBACNC,MAAM;wBACNP,OAAO;4BACLQ,WAAW,CAACC,OAASA,MAAMF,SAAS;4BACpCO,mBAAmB;4BACnBC,mBAAmB;4BACnBO,OAAO;wBACT;wBACAN,cAAc;oBAChB;iBACD;YACH;eACGxB;SACJ;QACD+B,OAAO;YACLC,cAAc;gBAACrC,iCAAiCG;aAAM;QACxD;IACF;AACF,EAAC"}

package/dist/collections/Roles.js

@@ -4,32 +4,35 @@ export const createRolesCollection = (options)=>{
     const customFields = options.rolesFields || [];
     return {
         slug,
+        access: options.rolesAccess || {
+            create: ()=>true,
+            delete: ()=>true,
+            read: ()=>true,
+            update: ()=>true
+        },
         admin: {
-            useAsTitle: 'name',
             group: 'Access Control',
-            hidden: options.hideRoles ?? false
-        },
-        access: {
-            read: ()=>true
+            hidden: options.hideRoles ?? false,
+            useAsTitle: 'name'
         },
         fields: [
             {
                 name: 'name',
                 type: 'text',
-                required: true,
-                unique: true,
                 admin: {
                     description: 'The unique name of the role (e.g., "admin", "editor").'
-                }
+                },
+                required: true,
+                unique: true
             },
             {
                 name: 'permissions',
                 type: 'relationship',
-                relationTo: permissionsSlug,
-                hasMany: true,
                 admin: {
                     description: 'The permissions assigned to this role.'
-                }
+                },
+                hasMany: true,
+                relationTo: permissionsSlug
             },
             ...customFields
         ]

package/dist/collections/Roles.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/collections/Roles.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload';\nimport type { PluginOptions } from '../types';\n\nexport const createRolesCollection = (options: PluginOptions): CollectionConfig => {\n  const slug = options.rolesCollectionSlug || 'roles'\n  const permissionsSlug = options.permissionsCollectionSlug || 'permissions'\n  const customFields = options.rolesFields || []\n\n  return {\n    slug,\n    admin: {\n      useAsTitle: 'name',\n      group: 'Access Control',\n      hidden: options.hideRoles ?? false,\n    },\n    access: {\n      read: () => true,\n    },\n    fields: [\n      {\n        name: 'name',\n        type: 'text',\n        required: true,\n        unique: true,\n        admin: {\n          description: 'The unique name of the role (e.g., \"admin\", \"editor\").',\n        },\n      },\n      {\n        name: 'permissions',\n        type: 'relationship',\n        relationTo: permissionsSlug,\n        hasMany: true,\n        admin: {\n          description: 'The permissions assigned to this role.',\n        },\n      },\n      ...customFields,\n    ],\n  }\n}\n"],"names":["createRolesCollection","options","slug","rolesCollectionSlug","permissionsSlug","permissionsCollectionSlug","customFields","rolesFields","admin","useAsTitle","group","hidden","hideRoles","access","read","fields","name","type","required","unique","description","relationTo","hasMany"],"mappings":"AAGA,OAAO,MAAMA,wBAAwB,CAACC;IACpC,MAAMC,OAAOD,QAAQE,mBAAmB,IAAI;IAC5C,MAAMC,kBAAkBH,QAAQI,yBAAyB,IAAI;IAC7D,MAAMC,eAAeL,QAAQM,WAAW,IAAI,EAAE;IAE9C,OAAO;QACLL;QACAM,OAAO;YACLC,YAAY;YACZC,OAAO;YACPC,QAAQV,QAAQW,SAAS,IAAI;QAC/B;QACAC,QAAQ;YACNC,MAAM,IAAM;QACd;QACAC,QAAQ;YACN;gBACEC,MAAM;gBACNC,MAAM;gBACNC,UAAU;gBACVC,QAAQ;gBACRX,OAAO;oBACLY,aAAa;gBACf;YACF;YACA;gBACEJ,MAAM;gBACNC,MAAM;gBACNI,YAAYjB;gBACZkB,SAAS;gBACTd,OAAO;oBACLY,aAAa;gBACf;YACF;eACGd;SACJ;IACH;AACF,EAAC"}
+{"version":3,"sources":["../../src/collections/Roles.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport type { PluginOptions } from '../types'\n\nexport const createRolesCollection = (options: PluginOptions): CollectionConfig => {\n  const slug = options.rolesCollectionSlug || 'roles'\n  const permissionsSlug = options.permissionsCollectionSlug || 'permissions'\n  const customFields = options.rolesFields || []\n\n  return {\n    slug,\n    access: options.rolesAccess || {\n      create: () => true,\n      delete: () => true,\n      read: () => true,\n      update: () => true,\n    },\n    admin: {\n      group: 'Access Control',\n      hidden: options.hideRoles ?? false,\n      useAsTitle: 'name',\n    },\n    fields: [\n      {\n        name: 'name',\n        type: 'text',\n        admin: {\n          description: 'The unique name of the role (e.g., \"admin\", \"editor\").',\n        },\n        required: true,\n        unique: true,\n      },\n      {\n        name: 'permissions',\n        type: 'relationship',\n        admin: {\n          description: 'The permissions assigned to this role.',\n        },\n        hasMany: true,\n        relationTo: permissionsSlug,\n      },\n      ...customFields,\n    ],\n  }\n}\n"],"names":["createRolesCollection","options","slug","rolesCollectionSlug","permissionsSlug","permissionsCollectionSlug","customFields","rolesFields","access","rolesAccess","create","delete","read","update","admin","group","hidden","hideRoles","useAsTitle","fields","name","type","description","required","unique","hasMany","relationTo"],"mappings":"AAIA,OAAO,MAAMA,wBAAwB,CAACC;IACpC,MAAMC,OAAOD,QAAQE,mBAAmB,IAAI;IAC5C,MAAMC,kBAAkBH,QAAQI,yBAAyB,IAAI;IAC7D,MAAMC,eAAeL,QAAQM,WAAW,IAAI,EAAE;IAE9C,OAAO;QACLL;QACAM,QAAQP,QAAQQ,WAAW,IAAI;YAC7BC,QAAQ,IAAM;YACdC,QAAQ,IAAM;YACdC,MAAM,IAAM;YACZC,QAAQ,IAAM;QAChB;QACAC,OAAO;YACLC,OAAO;YACPC,QAAQf,QAAQgB,SAAS,IAAI;YAC7BC,YAAY;QACd;QACAC,QAAQ;YACN;gBACEC,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,aAAa;gBACf;gBACAC,UAAU;gBACVC,QAAQ;YACV;YACA;gBACEJ,MAAM;gBACNC,MAAM;gBACNP,OAAO;oBACLQ,aAAa;gBACf;gBACAG,SAAS;gBACTC,YAAYtB;YACd;eACGE;SACJ;IACH;AACF,EAAC"}

package/dist/types.d.ts

@@ -1,47 +1,55 @@
 import type { Field } from 'payload';
 export interface PluginOptions {
+    /**
+     * The collection slug for the authentication collection (typically 'users')
+     * @default 'users'
+     */
+    authCollectionSlug?: string;
     /**
      * Enable or disable plugin
      * @default false
      */
     enabled?: boolean;
     /**
-     * Override the default collection slug for Roles
-     * @default 'roles'
+     * Hide the Permissions collection from the Admin panel sidebar/dashboard
+     * Can be a boolean or a function based on the logged-in user
+     * @default false
      */
-    rolesCollectionSlug?: string;
+    hidePermissions?: ((args: {
+        user: any;
+    }) => boolean) | boolean;
     /**
-     * Override the default collection slug for Permissions
-     * @default 'permissions'
+     * Hide the Roles collection from the Admin panel sidebar/dashboard
+     * Can be a boolean or a function based on the logged-in user
+     * @default false
      */
-    permissionsCollectionSlug?: string;
+    hideRoles?: ((args: {
+        user: any;
+    }) => boolean) | boolean;
     /**
-     * The collection slug for the authentication collection (typically 'users')
-     * @default 'users'
+     * Access control functions for the Permissions collection
      */
-    authCollectionSlug?: string;
+    permissionsAccess?: any;
     /**
-     * Inject additional custom fields into the generated Roles collection
+     * Override the default collection slug for Permissions
+     * @default 'permissions'
      */
-    rolesFields?: Field[];
+    permissionsCollectionSlug?: string;
     /**
      * Inject additional custom fields into the generated Permissions collection
      */
     permissionsFields?: Field[];
     /**
-     * Hide the Roles collection from the Admin panel sidebar/dashboard
-     * Can be a boolean or a function based on the logged-in user
-     * @default false
+     * Access control functions for the Roles collection
      */
-    hideRoles?: boolean | ((args: {
-        user: any;
-    }) => boolean);
+    rolesAccess?: any;
     /**
-     * Hide the Permissions collection from the Admin panel sidebar/dashboard
-     * Can be a boolean or a function based on the logged-in user
-     * @default false
+     * Override the default collection slug for Roles
+     * @default 'roles'
      */
-    hidePermissions?: boolean | ((args: {
-        user: any;
-    }) => boolean);
+    rolesCollectionSlug?: string;
+    /**
+     * Inject additional custom fields into the generated Roles collection
+     */
+    rolesFields?: Field[];
 }

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { Field } from 'payload'\n\nexport interface PluginOptions {\n  /**\n   * Enable or disable plugin\n   * @default false\n   */\n  enabled?: boolean\n\n  /**\n   * Override the default collection slug for Roles\n   * @default 'roles'\n   */\n  rolesCollectionSlug?: string\n\n  /**\n   * Override the default collection slug for Permissions\n   * @default 'permissions'\n   */\n  permissionsCollectionSlug?: string\n\n  /**\n   * The collection slug for the authentication collection (typically 'users')\n   * @default 'users'\n   */\n  authCollectionSlug?: string\n\n  /**\n   * Inject additional custom fields into the generated Roles collection\n   */\n  rolesFields?: Field[]\n\n  /**\n   * Inject additional custom fields into the generated Permissions collection\n   */\n  permissionsFields?: Field[]\n\n  /**\n   * Hide the Roles collection from the Admin panel sidebar/dashboard\n   * Can be a boolean or a function based on the logged-in user\n   * @default false\n   */\n  hideRoles?: boolean | ((args: { user: any }) => boolean)\n\n  /**\n   * Hide the Permissions collection from the Admin panel sidebar/dashboard\n   * Can be a boolean or a function based on the logged-in user\n   * @default false\n   */\n  hidePermissions?: boolean | ((args: { user: any }) => boolean)\n}\n"],"names":[],"mappings":"AAEA,WAgDC"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CollectionConfig, Field } from 'payload'\n\nexport interface PluginOptions {\n  /**\n   * The collection slug for the authentication collection (typically 'users')\n   * @default 'users'\n   */\n  authCollectionSlug?: string\n\n  /**\n   * Enable or disable plugin\n   * @default false\n   */\n  enabled?: boolean\n\n  /**\n   * Hide the Permissions collection from the Admin panel sidebar/dashboard\n   * Can be a boolean or a function based on the logged-in user\n   * @default false\n   */\n  hidePermissions?: ((args: { user: any }) => boolean) | boolean\n\n  /**\n   * Hide the Roles collection from the Admin panel sidebar/dashboard\n   * Can be a boolean or a function based on the logged-in user\n   * @default false\n   */\n  hideRoles?: ((args: { user: any }) => boolean) | boolean\n\n  /**\n   * Access control functions for the Permissions collection\n   */\n  permissionsAccess?: any\n\n  /**\n   * Override the default collection slug for Permissions\n   * @default 'permissions'\n   */\n  permissionsCollectionSlug?: string\n\n  /**\n   * Inject additional custom fields into the generated Permissions collection\n   */\n  permissionsFields?: Field[]\n\n  /**\n   * Access control functions for the Roles collection\n   */\n  rolesAccess?: any\n\n  /**\n   * Override the default collection slug for Roles\n   * @default 'roles'\n   */\n  rolesCollectionSlug?: string\n\n  /**\n   * Inject additional custom fields into the generated Roles collection\n   */\n  rolesFields?: Field[]\n}\n"],"names":[],"mappings":"AAEA,WA0DC"}

package/dist/utilities/checkPermission.d.ts

@@ -1,8 +1,7 @@
-import type { Access } from 'payload';
 /**
  * A Higher-Order Function to drop into Payload Collection access control fields.
  *
  * @param permissionName - The required permission name
  * @returns Access function
  */
-export declare const checkPermission: (permissionName: string) => Access;
+export declare const checkPermission: (permissionName: string) => any;

package/dist/utilities/checkPermission.js

@@ -1,4 +1,4 @@
-import { hasPermission } from './hasPermission';
+import { getPermissionQuery } from './getPermissionQuery';
 /**
  * A Higher-Order Function to drop into Payload Collection access control fields.
  * 
@@ -6,10 +6,10 @@ import { hasPermission } from './hasPermission';
  * @returns Access function
  */ export const checkPermission = (permissionName)=>{
     return ({ req: { user } })=>{
-        // We can just rely on the synchronous hasPermission check.
+        // Use getPermissionQuery which supports both boolean checks and ABAC conditions.
         // If relations are unpopulated, it will return false. Ensure your auth
         // collection is configured with adequate depth for saveToJWT or default depth.
-        return hasPermission(user, permissionName);
+        return getPermissionQuery(user, permissionName);
     };
 };
 

package/dist/utilities/checkPermission.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/checkPermission.ts"],"sourcesContent":["import type { Access } from 'payload';\nimport { hasPermission } from './hasPermission';\n\n/**\n * A Higher-Order Function to drop into Payload Collection access control fields.\n * \n * @param permissionName - The required permission name\n * @returns Access function\n */\nexport const checkPermission = (permissionName: string): Access => {\n  return ({ req: { user } }) => {\n    // We can just rely on the synchronous hasPermission check.\n    // If relations are unpopulated, it will return false. Ensure your auth\n    // collection is configured with adequate depth for saveToJWT or default depth.\n    return hasPermission(user, permissionName)\n  }\n}\n"],"names":["hasPermission","checkPermission","permissionName","req","user"],"mappings":"AACA,SAASA,aAAa,QAAQ,kBAAkB;AAEhD;;;;;CAKC,GACD,OAAO,MAAMC,kBAAkB,CAACC;IAC9B,OAAO,CAAC,EAAEC,KAAK,EAAEC,IAAI,EAAE,EAAE;QACvB,2DAA2D;QAC3D,uEAAuE;QACvE,+EAA+E;QAC/E,OAAOJ,cAAcI,MAAMF;IAC7B;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/checkPermission.ts"],"sourcesContent":["import { getPermissionQuery } from './getPermissionQuery';\n\n/**\n * A Higher-Order Function to drop into Payload Collection access control fields.\n * \n * @param permissionName - The required permission name\n * @returns Access function\n */\nexport const checkPermission = (permissionName: string): any => {\n  return ({ req: { user } }: any) => {\n    // Use getPermissionQuery which supports both boolean checks and ABAC conditions.\n    // If relations are unpopulated, it will return false. Ensure your auth\n    // collection is configured with adequate depth for saveToJWT or default depth.\n    return getPermissionQuery(user, permissionName)\n  }\n}\n"],"names":["getPermissionQuery","checkPermission","permissionName","req","user"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,uBAAuB;AAE1D;;;;;CAKC,GACD,OAAO,MAAMC,kBAAkB,CAACC;IAC9B,OAAO,CAAC,EAAEC,KAAK,EAAEC,IAAI,EAAE,EAAO;QAC5B,iFAAiF;QACjF,uEAAuE;QACvE,+EAA+E;QAC/E,OAAOJ,mBAAmBI,MAAMF;IAClC;AACF,EAAC"}

package/dist/utilities/getPermissionQuery.d.ts

@@ -0,0 +1,13 @@
+import type { PayloadRequest, Where } from 'payload';
+/**
+ * Checks if a user has a specific permission and evaluates its dynamic conditions.
+ *
+ * - If the user does not have the permission, returns false.
+ * - If the user has the permission without conditions, returns true.
+ * - If the user has the permission with conditions, returns a Payload `Where` object.
+ *
+ * @param user - The Payload user object from req.user
+ * @param requiredPermission - The name of the permission to check for
+ * @returns boolean | Where
+ */
+export declare const getPermissionQuery: (user: PayloadRequest["user"] | null | undefined, requiredPermission: string) => boolean | Where;

package/dist/utilities/getPermissionQuery.js

@@ -0,0 +1,86 @@
+/**
+ * Checks if a user has a specific permission and evaluates its dynamic conditions.
+ * 
+ * - If the user does not have the permission, returns false.
+ * - If the user has the permission without conditions, returns true.
+ * - If the user has the permission with conditions, returns a Payload `Where` object.
+ * 
+ * @param user - The Payload user object from req.user
+ * @param requiredPermission - The name of the permission to check for
+ * @returns boolean | Where
+ */ export const getPermissionQuery = (user, requiredPermission)=>{
+    if (!user || !user.roles || !Array.isArray(user.roles)) {
+        return false;
+    }
+    let hasPerm = false;
+    const allConditions = [];
+    for (const role of user.roles){
+        if (typeof role !== 'object' || role === null) {
+            continue;
+        }
+        const permissions = role.permissions;
+        if (!permissions || !Array.isArray(permissions)) {
+            continue;
+        }
+        for (const permission of permissions){
+            if (typeof permission === 'object' && permission !== null) {
+                if ('name' in permission && permission.name === requiredPermission) {
+                    hasPerm = true;
+                    // Collect conditions if they exist
+                    if ('conditions' in permission && Array.isArray(permission.conditions) && permission.conditions.length > 0) {
+                        allConditions.push(permission.conditions);
+                    } else {
+                        // If they have the permission WITHOUT conditions in ANY role, they get full access!
+                        return true;
+                    }
+                }
+            }
+        }
+    }
+    if (!hasPerm) {
+        return false;
+    }
+    // If they have the permission but ONLY with conditions, build the query.
+    if (allConditions.length > 0) {
+        const orConditions = allConditions.map((roleConditions)=>{
+            const andConditions = roleConditions.map((cond)=>{
+                let parsedValue = cond.value;
+                if (typeof parsedValue === 'string') {
+                    if (parsedValue === '{{user.roles}}') {
+                        parsedValue = user.roles?.map((r)=>typeof r === 'string' ? r : r?.id).filter(Boolean) || [];
+                    } else if (parsedValue === '{{user.role}}') {
+                        // Support for single role field if it exists
+                        const singleRole = user.role;
+                        parsedValue = typeof singleRole === 'object' && singleRole !== null ? singleRole.id : singleRole;
+                    } else if (parsedValue === '{{user.id}}') {
+                        parsedValue = user.id;
+                    } else if (parsedValue === 'true') {
+                        parsedValue = true;
+                    } else if (parsedValue === 'false') {
+                        parsedValue = false;
+                    } else {
+                        // Simple string replacement for embedded variables
+                        parsedValue = parsedValue.replace(/\{\{user\.id\}\}/g, String(user.id));
+                    }
+                }
+                return {
+                    [cond.field]: {
+                        [cond.operator]: parsedValue
+                    }
+                };
+            });
+            return {
+                and: andConditions
+            };
+        });
+        if (orConditions.length === 1) {
+            return orConditions[0];
+        }
+        return {
+            or: orConditions
+        };
+    }
+    return false;
+};
+
+//# sourceMappingURL=getPermissionQuery.js.map

package/dist/utilities/getPermissionQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getPermissionQuery.ts"],"sourcesContent":["import type { PayloadRequest, Where } from 'payload'\n\n/**\n * Checks if a user has a specific permission and evaluates its dynamic conditions.\n * \n * - If the user does not have the permission, returns false.\n * - If the user has the permission without conditions, returns true.\n * - If the user has the permission with conditions, returns a Payload `Where` object.\n * \n * @param user - The Payload user object from req.user\n * @param requiredPermission - The name of the permission to check for\n * @returns boolean | Where\n */\nexport const getPermissionQuery = (\n  user: PayloadRequest['user'] | null | undefined,\n  requiredPermission: string,\n): boolean | Where => {\n  if (!user || !user.roles || !Array.isArray(user.roles)) {\n    return false\n  }\n\n  let hasPerm = false\n  const allConditions: any[] = []\n\n  for (const role of user.roles) {\n    if (typeof role !== 'object' || role === null) {\n      continue\n    }\n\n    const permissions = role.permissions\n    if (!permissions || !Array.isArray(permissions)) {\n      continue\n    }\n\n    for (const permission of permissions) {\n      if (typeof permission === 'object' && permission !== null) {\n        if ('name' in permission && permission.name === requiredPermission) {\n          hasPerm = true\n\n          // Collect conditions if they exist\n          if (\n            'conditions' in permission &&\n            Array.isArray(permission.conditions) &&\n            permission.conditions.length > 0\n          ) {\n            allConditions.push(permission.conditions)\n          } else {\n            // If they have the permission WITHOUT conditions in ANY role, they get full access!\n            return true\n          }\n        }\n      }\n    }\n  }\n\n  if (!hasPerm) {\n    return false\n  }\n\n  // If they have the permission but ONLY with conditions, build the query.\n  if (allConditions.length > 0) {\n    const orConditions: Where[] = allConditions.map((roleConditions) => {\n      const andConditions = roleConditions.map((cond: any) => {\n        let parsedValue: any = cond.value\n\n        if (typeof parsedValue === 'string') {\n          if (parsedValue === '{{user.roles}}') {\n            parsedValue =\n              user.roles?.map((r: any) => (typeof r === 'string' ? r : r?.id)).filter(Boolean) || []\n          } else if (parsedValue === '{{user.role}}') {\n            // Support for single role field if it exists\n            const singleRole = (user as any).role\n            parsedValue = typeof singleRole === 'object' && singleRole !== null ? singleRole.id : singleRole\n          } else if (parsedValue === '{{user.id}}') {\n            parsedValue = user.id\n          } else if (parsedValue === 'true') {\n            parsedValue = true\n          } else if (parsedValue === 'false') {\n            parsedValue = false\n          } else {\n            // Simple string replacement for embedded variables\n            parsedValue = parsedValue.replace(/\\{\\{user\\.id\\}\\}/g, String(user.id))\n          }\n        }\n\n        return {\n          [cond.field]: {\n            [cond.operator]: parsedValue,\n          },\n        } as Where\n      })\n\n      return { and: andConditions } as Where\n    })\n\n    if (orConditions.length === 1) {\n      return orConditions[0] as Where\n    }\n\n    return { or: orConditions } as Where\n  }\n\n  return false\n}\n"],"names":["getPermissionQuery","user","requiredPermission","roles","Array","isArray","hasPerm","allConditions","role","permissions","permission","name","conditions","length","push","orConditions","map","roleConditions","andConditions","cond","parsedValue","value","r","id","filter","Boolean","singleRole","replace","String","field","operator","and","or"],"mappings":"AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMA,qBAAqB,CAChCC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACA,KAAKE,KAAK,IAAI,CAACC,MAAMC,OAAO,CAACJ,KAAKE,KAAK,GAAG;QACtD,OAAO;IACT;IAEA,IAAIG,UAAU;IACd,MAAMC,gBAAuB,EAAE;IAE/B,KAAK,MAAMC,QAAQP,KAAKE,KAAK,CAAE;QAC7B,IAAI,OAAOK,SAAS,YAAYA,SAAS,MAAM;YAC7C;QACF;QAEA,MAAMC,cAAcD,KAAKC,WAAW;QACpC,IAAI,CAACA,eAAe,CAACL,MAAMC,OAAO,CAACI,cAAc;YAC/C;QACF;QAEA,KAAK,MAAMC,cAAcD,YAAa;YACpC,IAAI,OAAOC,eAAe,YAAYA,eAAe,MAAM;gBACzD,IAAI,UAAUA,cAAcA,WAAWC,IAAI,KAAKT,oBAAoB;oBAClEI,UAAU;oBAEV,mCAAmC;oBACnC,IACE,gBAAgBI,cAChBN,MAAMC,OAAO,CAACK,WAAWE,UAAU,KACnCF,WAAWE,UAAU,CAACC,MAAM,GAAG,GAC/B;wBACAN,cAAcO,IAAI,CAACJ,WAAWE,UAAU;oBAC1C,OAAO;wBACL,oFAAoF;wBACpF,OAAO;oBACT;gBACF;YACF;QACF;IACF;IAEA,IAAI,CAACN,SAAS;QACZ,OAAO;IACT;IAEA,yEAAyE;IACzE,IAAIC,cAAcM,MAAM,GAAG,GAAG;QAC5B,MAAME,eAAwBR,cAAcS,GAAG,CAAC,CAACC;YAC/C,MAAMC,gBAAgBD,eAAeD,GAAG,CAAC,CAACG;gBACxC,IAAIC,cAAmBD,KAAKE,KAAK;gBAEjC,IAAI,OAAOD,gBAAgB,UAAU;oBACnC,IAAIA,gBAAgB,kBAAkB;wBACpCA,cACEnB,KAAKE,KAAK,EAAEa,IAAI,CAACM,IAAY,OAAOA,MAAM,WAAWA,IAAIA,GAAGC,IAAKC,OAAOC,YAAY,EAAE;oBAC1F,OAAO,IAAIL,gBAAgB,iBAAiB;wBAC1C,6CAA6C;wBAC7C,MAAMM,aAAa,AAACzB,KAAaO,IAAI;wBACrCY,cAAc,OAAOM,eAAe,YAAYA,eAAe,OAAOA,WAAWH,EAAE,GAAGG;oBACxF,OAAO,IAAIN,gBAAgB,eAAe;wBACxCA,cAAcnB,KAAKsB,EAAE;oBACvB,OAAO,IAAIH,gBAAgB,QAAQ;wBACjCA,cAAc;oBAChB,OAAO,IAAIA,gBAAgB,SAAS;wBAClCA,cAAc;oBAChB,OAAO;wBACL,mDAAmD;wBACnDA,cAAcA,YAAYO,OAAO,CAAC,qBAAqBC,OAAO3B,KAAKsB,EAAE;oBACvE;gBACF;gBAEA,OAAO;oBACL,CAACJ,KAAKU,KAAK,CAAC,EAAE;wBACZ,CAACV,KAAKW,QAAQ,CAAC,EAAEV;oBACnB;gBACF;YACF;YAEA,OAAO;gBAAEW,KAAKb;YAAc;QAC9B;QAEA,IAAIH,aAAaF,MAAM,KAAK,GAAG;YAC7B,OAAOE,YAAY,CAAC,EAAE;QACxB;QAEA,OAAO;YAAEiB,IAAIjB;QAAa;IAC5B;IAEA,OAAO;AACT,EAAC"}

package/dist/utilities/getPermissionQuery.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utilities/getPermissionQuery.spec.js

@@ -0,0 +1,244 @@
+import { describe, expect, it } from 'vitest';
+import { getPermissionQuery } from './getPermissionQuery';
+describe('getPermissionQuery', ()=>{
+    it('should return false if user is null', ()=>{
+        expect(getPermissionQuery(null, 'read:posts')).toBe(false);
+    });
+    it('should return false if user has no roles array', ()=>{
+        const user = {
+            id: '1'
+        };
+        expect(getPermissionQuery(user, 'read:posts')).toBe(false);
+    });
+    it('should return false if user roles is unpopulated', ()=>{
+        const user = {
+            id: '1',
+            roles: [
+                'role-id-1'
+            ]
+        };
+        expect(getPermissionQuery(user, 'read:posts')).toBe(false);
+    });
+    it('should return false if role has no permissions', ()=>{
+        const user = {
+            id: '1',
+            roles: [
+                {
+                    id: 'role-1',
+                    name: 'admin'
+                }
+            ]
+        };
+        expect(getPermissionQuery(user, 'read:posts')).toBe(false);
+    });
+    it('should return true if permission is found without conditions', ()=>{
+        const user = {
+            id: '1',
+            roles: [
+                {
+                    id: 'role-1',
+                    name: 'admin',
+                    permissions: [
+                        {
+                            id: 'perm-1',
+                            name: 'read:posts'
+                        },
+                        {
+                            id: 'perm-2',
+                            name: 'write:posts'
+                        }
+                    ]
+                }
+            ]
+        };
+        expect(getPermissionQuery(user, 'read:posts')).toBe(true);
+    });
+    it('should return a Where object if permission has conditions', ()=>{
+        const user = {
+            id: 'user-1',
+            roles: [
+                {
+                    id: 'role-1',
+                    name: 'editor',
+                    permissions: [
+                        {
+                            id: 'perm-1',
+                            name: 'read:posts',
+                            conditions: [
+                                {
+                                    field: 'sender',
+                                    operator: 'equals',
+                                    value: '{{user.id}}'
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ]
+        };
+        const query = getPermissionQuery(user, 'read:posts');
+        expect(query).toEqual({
+            and: [
+                {
+                    sender: {
+                        equals: 'user-1'
+                    }
+                }
+            ]
+        });
+    });
+    it('should return true if one role has conditions but another role gives full access', ()=>{
+        const user = {
+            id: 'user-1',
+            roles: [
+                {
+                    id: 'role-1',
+                    name: 'editor',
+                    permissions: [
+                        {
+                            id: 'perm-1',
+                            name: 'read:posts',
+                            conditions: [
+                                {
+                                    field: 'sender',
+                                    operator: 'equals',
+                                    value: '{{user.id}}'
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    id: 'role-2',
+                    name: 'admin',
+                    permissions: [
+                        {
+                            id: 'perm-2',
+                            name: 'read:posts'
+                        }
+                    ]
+                }
+            ]
+        };
+        // The user has full 'read:posts' from admin role, so they get full access (true)
+        const query = getPermissionQuery(user, 'read:posts');
+        expect(query).toBe(true);
+    });
+    it('should return an OR Where object if multiple roles have different conditions', ()=>{
+        const user = {
+            id: 'user-1',
+            roles: [
+                {
+                    id: 'role-1',
+                    name: 'editor',
+                    permissions: [
+                        {
+                            id: 'perm-1',
+                            name: 'read:posts',
+                            conditions: [
+                                {
+                                    field: 'author',
+                                    operator: 'equals',
+                                    value: '{{user.id}}'
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    id: 'role-2',
+                    name: 'manager',
+                    permissions: [
+                        {
+                            id: 'perm-2',
+                            name: 'read:posts',
+                            conditions: [
+                                {
+                                    field: 'status',
+                                    operator: 'equals',
+                                    value: 'published'
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ]
+        };
+        const query = getPermissionQuery(user, 'read:posts');
+        expect(query).toEqual({
+            or: [
+                {
+                    and: [
+                        {
+                            author: {
+                                equals: 'user-1'
+                            }
+                        }
+                    ]
+                },
+                {
+                    and: [
+                        {
+                            status: {
+                                equals: 'published'
+                            }
+                        }
+                    ]
+                }
+            ]
+        });
+    });
+    it('should correctly map {{user.roles}} and boolean string values', ()=>{
+        const user = {
+            id: 'user-1',
+            roles: [
+                {
+                    id: 'role-1',
+                    name: 'editor',
+                    permissions: [
+                        {
+                            id: 'perm-1',
+                            name: 'read:posts',
+                            conditions: [
+                                {
+                                    field: 'role',
+                                    operator: 'in',
+                                    value: '{{user.roles}}'
+                                },
+                                {
+                                    field: 'isPublic',
+                                    operator: 'equals',
+                                    value: 'true'
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    id: 'role-2',
+                    name: 'manager'
+                }
+            ]
+        };
+        const query = getPermissionQuery(user, 'read:posts');
+        expect(query).toEqual({
+            and: [
+                {
+                    role: {
+                        in: [
+                            'role-1',
+                            'role-2'
+                        ]
+                    }
+                },
+                {
+                    isPublic: {
+                        equals: true
+                    }
+                }
+            ]
+        });
+    });
+});
+
+//# sourceMappingURL=getPermissionQuery.spec.js.map

package/dist/utilities/getPermissionQuery.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getPermissionQuery.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\nimport { describe, expect, it } from 'vitest'\nimport { getPermissionQuery } from './getPermissionQuery'\n\ndescribe('getPermissionQuery', () => {\n  it('should return false if user is null', () => {\n    expect(getPermissionQuery(null, 'read:posts')).toBe(false)\n  })\n\n  it('should return false if user has no roles array', () => {\n    const user = { id: '1' } as PayloadRequest['user']\n    expect(getPermissionQuery(user, 'read:posts')).toBe(false)\n  })\n\n  it('should return false if user roles is unpopulated', () => {\n    const user = {\n      id: '1',\n      roles: ['role-id-1'],\n    } as unknown as PayloadRequest['user']\n    expect(getPermissionQuery(user, 'read:posts')).toBe(false)\n  })\n\n  it('should return false if role has no permissions', () => {\n    const user = {\n      id: '1',\n      roles: [{ id: 'role-1', name: 'admin' }],\n    } as unknown as PayloadRequest['user']\n    expect(getPermissionQuery(user, 'read:posts')).toBe(false)\n  })\n\n  it('should return true if permission is found without conditions', () => {\n    const user = {\n      id: '1',\n      roles: [\n        {\n          id: 'role-1',\n          name: 'admin',\n          permissions: [\n            { id: 'perm-1', name: 'read:posts' },\n            { id: 'perm-2', name: 'write:posts' },\n          ],\n        },\n      ],\n    } as unknown as PayloadRequest['user']\n    expect(getPermissionQuery(user, 'read:posts')).toBe(true)\n  })\n\n  it('should return a Where object if permission has conditions', () => {\n    const user = {\n      id: 'user-1',\n      roles: [\n        {\n          id: 'role-1',\n          name: 'editor',\n          permissions: [\n            {\n              id: 'perm-1',\n              name: 'read:posts',\n              conditions: [\n                { field: 'sender', operator: 'equals', value: '{{user.id}}' },\n              ],\n            },\n          ],\n        },\n      ],\n    } as unknown as PayloadRequest['user']\n\n    const query = getPermissionQuery(user, 'read:posts')\n    expect(query).toEqual({\n      and: [\n        {\n          sender: { equals: 'user-1' },\n        },\n      ],\n    })\n  })\n\n  it('should return true if one role has conditions but another role gives full access', () => {\n    const user = {\n      id: 'user-1',\n      roles: [\n        {\n          id: 'role-1',\n          name: 'editor',\n          permissions: [\n            {\n              id: 'perm-1',\n              name: 'read:posts',\n              conditions: [\n                { field: 'sender', operator: 'equals', value: '{{user.id}}' },\n              ],\n            },\n          ],\n        },\n        {\n          id: 'role-2',\n          name: 'admin',\n          permissions: [{ id: 'perm-2', name: 'read:posts' }],\n        },\n      ],\n    } as unknown as PayloadRequest['user']\n\n    // The user has full 'read:posts' from admin role, so they get full access (true)\n    const query = getPermissionQuery(user, 'read:posts')\n    expect(query).toBe(true)\n  })\n\n  it('should return an OR Where object if multiple roles have different conditions', () => {\n    const user = {\n      id: 'user-1',\n      roles: [\n        {\n          id: 'role-1',\n          name: 'editor',\n          permissions: [\n            {\n              id: 'perm-1',\n              name: 'read:posts',\n              conditions: [\n                { field: 'author', operator: 'equals', value: '{{user.id}}' },\n              ],\n            },\n          ],\n        },\n        {\n          id: 'role-2',\n          name: 'manager',\n          permissions: [\n            {\n              id: 'perm-2',\n              name: 'read:posts',\n              conditions: [\n                { field: 'status', operator: 'equals', value: 'published' },\n              ],\n            },\n          ],\n        },\n      ],\n    } as unknown as PayloadRequest['user']\n\n    const query = getPermissionQuery(user, 'read:posts')\n    expect(query).toEqual({\n      or: [\n        {\n          and: [\n            { author: { equals: 'user-1' } },\n          ],\n        },\n        {\n          and: [\n            { status: { equals: 'published' } },\n          ],\n        },\n      ],\n    })\n  })\n\n  it('should correctly map {{user.roles}} and boolean string values', () => {\n    const user = {\n      id: 'user-1',\n      roles: [\n        { \n          id: 'role-1', \n          name: 'editor',\n          permissions: [\n            {\n              id: 'perm-1',\n              name: 'read:posts',\n              conditions: [\n                { field: 'role', operator: 'in', value: '{{user.roles}}' },\n                { field: 'isPublic', operator: 'equals', value: 'true' },\n              ],\n            },\n          ]\n        },\n        { id: 'role-2', name: 'manager' }\n      ],\n    } as unknown as PayloadRequest['user']\n\n    const query = getPermissionQuery(user, 'read:posts')\n    expect(query).toEqual({\n      and: [\n        { role: { in: ['role-1', 'role-2'] } },\n        { isPublic: { equals: true } },\n      ],\n    })\n  })\n})\n"],"names":["describe","expect","it","getPermissionQuery","toBe","user","id","roles","name","permissions","conditions","field","operator","value","query","toEqual","and","sender","equals","or","author","status","role","in","isPublic"],"mappings":"AACA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAC7C,SAASC,kBAAkB,QAAQ,uBAAsB;AAEzDH,SAAS,sBAAsB;IAC7BE,GAAG,uCAAuC;QACxCD,OAAOE,mBAAmB,MAAM,eAAeC,IAAI,CAAC;IACtD;IAEAF,GAAG,kDAAkD;QACnD,MAAMG,OAAO;YAAEC,IAAI;QAAI;QACvBL,OAAOE,mBAAmBE,MAAM,eAAeD,IAAI,CAAC;IACtD;IAEAF,GAAG,oDAAoD;QACrD,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBAAC;aAAY;QACtB;QACAN,OAAOE,mBAAmBE,MAAM,eAAeD,IAAI,CAAC;IACtD;IAEAF,GAAG,kDAAkD;QACnD,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBAAC;oBAAED,IAAI;oBAAUE,MAAM;gBAAQ;aAAE;QAC1C;QACAP,OAAOE,mBAAmBE,MAAM,eAAeD,IAAI,CAAC;IACtD;IAEAF,GAAG,gEAAgE;QACjE,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBACL;oBACED,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBACX;4BAAEH,IAAI;4BAAUE,MAAM;wBAAa;wBACnC;4BAAEF,IAAI;4BAAUE,MAAM;wBAAc;qBACrC;gBACH;aACD;QACH;QACAP,OAAOE,mBAAmBE,MAAM,eAAeD,IAAI,CAAC;IACtD;IAEAF,GAAG,6DAA6D;QAC9D,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBACL;oBACED,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBACX;4BACEH,IAAI;4BACJE,MAAM;4BACNE,YAAY;gCACV;oCAAEC,OAAO;oCAAUC,UAAU;oCAAUC,OAAO;gCAAc;6BAC7D;wBACH;qBACD;gBACH;aACD;QACH;QAEA,MAAMC,QAAQX,mBAAmBE,MAAM;QACvCJ,OAAOa,OAAOC,OAAO,CAAC;YACpBC,KAAK;gBACH;oBACEC,QAAQ;wBAAEC,QAAQ;oBAAS;gBAC7B;aACD;QACH;IACF;IAEAhB,GAAG,oFAAoF;QACrF,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBACL;oBACED,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBACX;4BACEH,IAAI;4BACJE,MAAM;4BACNE,YAAY;gCACV;oCAAEC,OAAO;oCAAUC,UAAU;oCAAUC,OAAO;gCAAc;6BAC7D;wBACH;qBACD;gBACH;gBACA;oBACEP,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBAAC;4BAAEH,IAAI;4BAAUE,MAAM;wBAAa;qBAAE;gBACrD;aACD;QACH;QAEA,iFAAiF;QACjF,MAAMM,QAAQX,mBAAmBE,MAAM;QACvCJ,OAAOa,OAAOV,IAAI,CAAC;IACrB;IAEAF,GAAG,gFAAgF;QACjF,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBACL;oBACED,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBACX;4BACEH,IAAI;4BACJE,MAAM;4BACNE,YAAY;gCACV;oCAAEC,OAAO;oCAAUC,UAAU;oCAAUC,OAAO;gCAAc;6BAC7D;wBACH;qBACD;gBACH;gBACA;oBACEP,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBACX;4BACEH,IAAI;4BACJE,MAAM;4BACNE,YAAY;gCACV;oCAAEC,OAAO;oCAAUC,UAAU;oCAAUC,OAAO;gCAAY;6BAC3D;wBACH;qBACD;gBACH;aACD;QACH;QAEA,MAAMC,QAAQX,mBAAmBE,MAAM;QACvCJ,OAAOa,OAAOC,OAAO,CAAC;YACpBI,IAAI;gBACF;oBACEH,KAAK;wBACH;4BAAEI,QAAQ;gCAAEF,QAAQ;4BAAS;wBAAE;qBAChC;gBACH;gBACA;oBACEF,KAAK;wBACH;4BAAEK,QAAQ;gCAAEH,QAAQ;4BAAY;wBAAE;qBACnC;gBACH;aACD;QACH;IACF;IAEAhB,GAAG,iEAAiE;QAClE,MAAMG,OAAO;YACXC,IAAI;YACJC,OAAO;gBACL;oBACED,IAAI;oBACJE,MAAM;oBACNC,aAAa;wBACX;4BACEH,IAAI;4BACJE,MAAM;4BACNE,YAAY;gCACV;oCAAEC,OAAO;oCAAQC,UAAU;oCAAMC,OAAO;gCAAiB;gCACzD;oCAAEF,OAAO;oCAAYC,UAAU;oCAAUC,OAAO;gCAAO;6BACxD;wBACH;qBACD;gBACH;gBACA;oBAAEP,IAAI;oBAAUE,MAAM;gBAAU;aACjC;QACH;QAEA,MAAMM,QAAQX,mBAAmBE,MAAM;QACvCJ,OAAOa,OAAOC,OAAO,CAAC;YACpBC,KAAK;gBACH;oBAAEM,MAAM;wBAAEC,IAAI;4BAAC;4BAAU;yBAAS;oBAAC;gBAAE;gBACrC;oBAAEC,UAAU;wBAAEN,QAAQ;oBAAK;gBAAE;aAC9B;QACH;IACF;AACF"}

package/dist/utilities/index.d.ts

@@ -1,2 +1,3 @@
 export { checkPermission } from './checkPermission';
+export { getPermissionQuery } from './getPermissionQuery';
 export { hasPermission } from './hasPermission';

package/dist/utilities/index.js

@@ -1,4 +1,5 @@
 export { checkPermission } from './checkPermission';
+export { getPermissionQuery } from './getPermissionQuery';
 export { hasPermission } from './hasPermission';
 
 //# sourceMappingURL=index.js.map

package/dist/utilities/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/index.ts"],"sourcesContent":["export { checkPermission } from './checkPermission';\nexport { hasPermission } from './hasPermission';\n\n"],"names":["checkPermission","hasPermission"],"mappings":"AAAA,SAASA,eAAe,QAAQ,oBAAoB;AACpD,SAASC,aAAa,QAAQ,kBAAkB"}
+{"version":3,"sources":["../../src/utilities/index.ts"],"sourcesContent":["export { checkPermission } from './checkPermission';\nexport { getPermissionQuery } from './getPermissionQuery';\nexport { hasPermission } from './hasPermission';\n\n"],"names":["checkPermission","getPermissionQuery","hasPermission"],"mappings":"AAAA,SAASA,eAAe,QAAQ,oBAAoB;AACpD,SAASC,kBAAkB,QAAQ,uBAAuB;AAC1D,SAASC,aAAa,QAAQ,kBAAkB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload-rbac-plugin",
-  "version": "1.0.3rc1",
+  "version": "1.0.5rc",
   "description": "RBAC plugin for payloadcms",
   "repository": {
     "type": "git",
@@ -52,13 +52,13 @@
   ],
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
-    "@payloadcms/db-mongodb": "3.84.1",
-    "@payloadcms/db-postgres": "3.84.1",
-    "@payloadcms/db-sqlite": "3.84.1",
+    "@payloadcms/db-mongodb": "^3.85.0",
+    "@payloadcms/db-postgres": "^3.85.0",
+    "@payloadcms/db-sqlite": "^3.85.0",
     "@payloadcms/eslint-config": "3.28.0",
-    "@payloadcms/next": "3.84.1",
-    "@payloadcms/richtext-lexical": "3.84.1",
-    "@payloadcms/ui": "3.84.1",
+    "@payloadcms/next": "^3.85.0",
+    "@payloadcms/richtext-lexical": "^3.85.0",
+    "@payloadcms/ui": "^3.85.0",
     "@playwright/test": "1.58.2",
     "@swc-node/register": "1.10.9",
     "@swc/cli": "0.6.0",
@@ -73,7 +73,7 @@
     "mongodb-memory-server": "10.1.4",
     "next": "16.2.6",
     "open": "^10.1.0",
-    "payload": "3.84.1",
+    "payload": "^3.85.0",
     "prettier": "^3.4.2",
     "qs-esm": "8.0.1",
     "react": "19.2.6",
@@ -86,7 +86,7 @@
     "vitest": "^4.1.8"
   },
   "peerDependencies": {
-    "payload": "^3.84.1"
+    "payload": "^3.85.0"
   },
   "engines": {
     "node": "^18.20.2 || >=20.9.0",